Procedure examples

Qilin has pushed scheduled tasks via Group Policy Objects (GPOs) for execution. Qilin has also created a scheduled task named TVInstallRestore, configured to run at logon using the `/SC ONLOGON` argument.

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.

SoreFang can gain persistence through use of scheduled tasks.

One persistence mechanism used by CozyCar is to register itself as a scheduled task.

Agent Tesla has achieved persistence via scheduled tasks.

POWERSTATS has established persistence through a scheduled task using the command ”C:\Windows\system32\schtasks.exe” /Create /F /SC DAILY /ST 12:00 /TN MicrosoftEdge /TR “c:\Windows\system32\wscript.exe C:\Windows\temp\Windows.vbe”.

BADNEWS creates a scheduled task to establish by executing a malicious payload every subsequent minute.

Goopy has the ability to maintain persistence by creating scheduled tasks set to run every hour.

Remexi utilizes scheduled tasks as a persistence mechanism.

QakBot has the ability to create scheduled tasks for persistence.

Helminth has used a scheduled task for persistence.

Dridex can maintain persistence via the creation of scheduled tasks within system directories such as `windows\system32\`, `windows\syswow64,` `winnt\system32`, and `winnt\syswow64`.

JSS Loader has the ability to launch scheduled tasks to establish persistence.

StrifeWater has create a scheduled task named `Mozilla\Firefox Default Browser Agent 409046Z0FF4A39CB` for persistence.

PowerSploit's New-UserPersistenceOption Persistence argument can be used to establish via a Scheduled Task/Job.

Empire has modules to interact with the Windows task scheduler.

CSPY Downloader can use the schtasks utility to bypass UAC.

AsyncRAT can create a scheduled task to maintain persistence on system start-up.

MCMD can use scheduled tasks for persistence.

IronNetInjector has used a task XML file named mssch.xml to run an IronPython script when a user logs in or when specific system events are created.

Koadic has used scheduled tasks to add persistence.

schtasks is used to schedule tasks on a Windows system to run at a specific date and time.

QuasarRAT contains a .NET wrapper DLL for creating and managing scheduled tasks for maintaining persistence upon reboot.

Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware.